CVE-2026-61519 Liberu CRM 0.9.1 < 10.0.0 Broken Access Control via TeamPolicy::addTeamMember()
Attackers with pending invitations can invite admin accounts, gaining full control over team data in Liberu CRM.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-61519?
CVE-2026-61519 is a high-severity vulnerability in Liberu CRM, published on 29 Sep 2026. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
Liberu CRM 0.9.1 before 10.0.0 contains a broken access control vulnerability that allows any user holding a pending team invitation to invite additional attacker-controlled accounts with elevated privileges by exploiting a flawed authorization predicate in TeamPolicy::addTeamMember() that grants invitation rights based solely on the existence of a pending invitation email match. Attackers can send a POST request to the team-invitations route specifying the admin role for a second account, bypassing privilege-level validation in InviteTeamMember, causing the second account upon invitation acceptance to be attached to the team with full admin-level create, read, update, and delete access over all team-scoped data.
Weakness: CWE-863
Which versions are affected by CVE-2026-61519?
How do I fix CVE-2026-61519?
No fix has been published for CVE-2026-61519 yet. Limit exposure of the affected software until one is available.
Is CVE-2026-61519 being exploited?
There is no known exploitation of CVE-2026-61519 in the wild and no public exploit code.
Sources
Also known as GHSA-2xh3-6r9v-rqmp.